Workflow & Automation · commodityai.comCommodityAI
Graded against 811 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
No lens is bandable yet — banding requires fully verified documents with on-criteria findings. The gap is shown honestly, never estimated.
Partially verified: Privacy Policy assessed. Everything below comes only from what was read in full.
Watch: Data retention
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Establishes a retention obligation limiting personal information storage to what is necessary for stated purposes, caps retention at 90 days absent legal requirements, and obligates deletion or anonymization when no ongoing legitimate business need exists.
States that information may be shared in specific situations and with specific third parties, acknowledging the existence of sharing arrangements and conditioning them on specificity, which operates as a scoping commitment.
States the conditions under which the company may share personal information, identifying specific situations and third-party categories as the basis for permissible disclosure.
How to read this page: Overall risk rates what CommodityAI's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Partially verified — Privacy Policy — Verified (read in full, 76 findings). Findings below are from fully-read, verified documents only; remaining core documents are pending capture.
Terms not yet captured
AIRIN has not yet captured a gate-verified Terms of Service document for this platform.
- Privacy PolicyVerified - read in full - 76 citationsLast captured 2026-07-20
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Provides an exception allowing processing without consent for business transactions, subject to certain unspecified conditions being met.
" • For business transactions provided certain conditions are met"
Defines the general principle that processing only occurs when necessary and a valid legal basis exists, and names the categories of legal bases relied upon, including consent, legal compliance, contractual obligations, rights protection, and legitimate business interests.
" We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to ente..."
Provides an exception allowing processing without consent when information was produced by an individual in the course of employment, business, or profession and collection is consistent with the purposes for which it was produced.
" • If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced"
Lists examples of audio/sensory information (images, audio, video, call recordings) and discloses this category is NOT collected in connection with business activities — user-favorable disclosure.
" Images and audio, video or call recordings created in connection with our business activities NO"
Lists examples of professional/employment information (business contact details, job title, work history) and discloses this category is NOT collected except in the context of job applications — user-favorable disclosure with a scoped exception.
" Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us NO"
Establishes a retention obligation limiting personal information storage to what is necessary for stated purposes, caps retention at 90 days absent legal requirements, and obligates deletion or anonymization when no ongoing legitimate business need exists.
" We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set ou..."
Grants the company permission to share or transfer user personal information in the context of mergers, asset sales, financing, or acquisitions, establishing a broad business-transfer data-sharing right.
" • Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company."
This segment states that personal information may be disclosed to service providers under written contracts, that it may be used for internal research and technological development (not considered a 'sale'), and that no personal information has been sold or shared with third parties for commercial purposes, establishing both a sharing permission and a protective disclaimer against sale.
" We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, “WHEN AND WITH WHOM DO WE SHARE..."
Clause A implies that submitting a data subject access request is the method for exercising certain rights, while Clause B states that users can also email or use other contact details to exercise those same rights, creating conflicting instructions.
" Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please fill out and submit a data subject access request."
" To exercise these rights, you can contact us by submitting a data subject access request, by emailing us at security@commodityai.io, or by referring to the contact details at the bottom of this document. Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws."
Within one documentClause A states that the company has not disclosed any personal information to third parties for business purposes, directly contradicting Clause B's explicit statement that personal information will be shared with third-party AI Service Providers for product functionality.
" We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?” We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be “selling” of your personal information. We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers."
" We provide the AI Products through third-party service providers (“AI Service Providers”), including Anthropic, Google Cloud AI, and OpenAI. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in “WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?” You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider."
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than 90 days. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible."
Establishes a retention obligation limiting personal information storage to what is necessary for stated purposes, caps retention at 90 days absent legal requirements, and obligates deletion or anonymization when no ongoing legitimate business need exists.
AI-generated interpretation, not legal advice.
" We may share information in specific situations and with specific third parties."
States that information may be shared in specific situations and with specific third parties, acknowledging the existence of sharing arrangements and conditioning them on specificity, which operates as a scoping commitment.
AI-generated interpretation, not legal advice.
" We may share information in specific situations described in this section and/or with the following third parties. We may need to share your personal information in the following situations:"
States the conditions under which the company may share personal information, identifying specific situations and third-party categories as the basis for permissible disclosure.
AI-generated interpretation, not legal advice.
" We provide the AI Products through third-party service providers (“AI Service Providers”), including Anthropic, Google Cloud AI, and OpenAI. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in “WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?” You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider."
Discloses that user input, output, and personal information will be shared with and processed by named third-party AI service providers to enable AI product functionality, and imposes a restriction on users not to violate those providers' terms or policies.
AI-generated interpretation, not legal advice.
" We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?” We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be “selling” of your personal information. We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers."
This segment states that personal information may be disclosed to service providers under written contracts, that it may be used for internal research and technological development (not considered a 'sale'), and that no personal information has been sold or shared with third parties for commercial purposes, establishing both a sharing permission and a protective disclaimer against sale.
AI-generated interpretation, not legal advice.
" • For business transactions provided certain conditions are met"
Provides an exception allowing processing without consent for business transactions, subject to certain unspecified conditions being met.
AI-generated interpretation, not legal advice.
" We do not process sensitive personal information."
Affirmatively states that the company does not process sensitive personal information, establishing a restriction — user-favorable — on the categories of data that may be collected.
AI-generated interpretation, not legal advice.
" We do not process sensitive information. All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information."
Declares that the organization does not process sensitive information — a protective restriction — and imposes an obligation on users to provide only true, complete, and accurate personal information and to notify of any changes.
AI-generated interpretation, not legal advice.
" • If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way"
Provides an exception allowing processing without consent when collection is clearly in the individual's interests and consent cannot be obtained in a timely manner.
AI-generated interpretation, not legal advice.
" • For investigations and fraud detection and prevention"
Provides an exception allowing processing without consent for the purposes of investigations and fraud detection and prevention.
AI-generated interpretation, not legal advice.
" • If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim"
Provides an exception allowing processing without consent when information is contained in a witness statement and collection is necessary to assess, process, or settle an insurance claim.
AI-generated interpretation, not legal advice.
" • For identifying injured, ill, or deceased persons and communicating with next of kin"
Provides an exception allowing processing without consent for the purpose of identifying injured, ill, or deceased persons and communicating with their next of kin.
AI-generated interpretation, not legal advice.
" • If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse"
Provides an exception allowing processing without consent where there are reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse.
AI-generated interpretation, not legal advice.
" • If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province"
Provides an exception allowing processing without consent where obtaining consent would compromise the availability or accuracy of the information and the collection is reasonable for investigating a breach of an agreement or contravention of laws.
AI-generated interpretation, not legal advice.
" • If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records"
Provides an exception allowing disclosure without consent when required to comply with a subpoena, warrant, court order, or rules of court relating to production of records.
AI-generated interpretation, not legal advice.
" • If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced"
Provides an exception allowing processing without consent when information was produced by an individual in the course of employment, business, or profession and collection is consistent with the purposes for which it was produced.
AI-generated interpretation, not legal advice.
" • If the collection is solely for journalistic, artistic, or literary purposes"
Provides an exception allowing processing without consent when the sole purpose of collection is journalistic, artistic, or literary.
AI-generated interpretation, not legal advice.
" • If the information is publicly available and is specified by the regulations"
Provides an exception allowing processing without consent when the information is publicly available and is specified by applicable regulations.
AI-generated interpretation, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from CommodityAI's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
0 verified clausesClauses in CommodityAI's policies that work in your favour — commitments the platform made to you.
No protective clause has been verified in CommodityAI's published policies yet. That means we did not find one in the documents we read — not that the platform offers nothing.
📋 Rules you must follow
0 verified clausesWhat CommodityAI requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in CommodityAI's published policies yet.
What the policies actually cover
0 topicsNone of CommodityAI's verified clauses has been assigned a topic yet. The clause-trust review has not reached this platform's findings.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause allows indefinite, perpetual, or necessity-based retention.
“We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will r...”Open source citation
The clause permits sale of personal data or information.
“We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction. We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 o...”Open source citation
The clause permits sale of personal data or information.
“We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?” We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demon...”Open source citation
The clause permits sale of personal data or information.
“• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)”Open source citation
The clause permits disclosure or sharing with third parties, affiliates, vendors, or subprocessors.
“We may share information in specific situations and with specific third parties.”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | privacy data use | worsens | HIGH | 1 |
| All applicable tiers | subprocessors data sharing | worsens | HIGH | 4 |
| Team / Business | data retention | conditional | MEDIUM | 1 |
| Team / Business | subprocessors data sharing | worsens | HIGH | 2 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
Latest stance: third party or vendor sharing on subprocessors data sharing
“We may share information in specific situations and with specific third parties.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“We may share information in specific situations described in this section and/or with the following third parties. We may need to share your personal information in the following situations:”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“We provide the AI Products through third-party service providers (“AI Service Providers”), including Anthropic, Google Cloud AI, and OpenAI. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in “WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?” You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.”Open timeline citation
Latest stance: sale or sell on privacy data use
“We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction. We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age or the equivalent age as specified by law in your jurisdiction has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18 or the equivalent age as specified by law in your jurisdiction, please contact us at security@commodityai.io.”Open timeline citation
Latest stance: sale or sell on subprocessors data sharing
“We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?” We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be “selling” of your personal information. We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?” We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be “selling” of your personal information. We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers.”Open timeline citation
Latest stance: sale or sell on subprocessors data sharing
“• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)”Open timeline citation
Latest stance: indefinite or necessity based on data retention
“We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than 90 days. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-07-20· verified 2026-07-20verified once — not yet re-verified
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
85 findings first captured First scan: July 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of CommodityAI's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Know where the missing document lives?
We haven't yet verified CommodityAI's Terms of Service. Point us at the official page and our pipeline will attempt to capture and read it in full. Submissions are candidates only — nothing is published until it passes the same verification gates as every other document on this site.
Every finding above is a verbatim quote from CommodityAI's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.